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Redundant brake control system for a vehicle 

The present invention relates to a brake control system 
5 for a vehicle, in particular a commercial vehicle, 
wherein the vehicle comprises at least one front axle 
with at least one left-hand front wheel and at least 
one right-hand front wheel and at least one rear axle 
with at least one left-hand rear wheel and at least one 
10 right-hand rear wheel, wherein the brake control system 
comprises a service brake for braking the wheels of the 
vehicle . 



DE 100 32 179 Al discloses a vehicle with a control 

15 system which operates with an electronically actuatable 
drive train, which comprises at least one steering 
system and one drive unit of the vehicle. The known 
control system has an input level with devices for 
inputting values continuously preset by a driver and 

20 converting these preset values into setpoint signals. 
The control system further comprises a coordination 
level for converting the setpoint signals into 
triggering signals, which are converted by actuators of 
the drive train. In other words, the control system has 

25 a control device which, from a motion vector on the 
input side, generates on the output side control 
signals for actuating the drive train and which is 
coupled to the drive train for transmission of the 
control signals, said drive train then executing the 

30 control signals in order to implement the driver's 
wishes, i.e. it is a so-called "drive-by-wire system" 
or "X-by-wire system" . 

DE 100 46 832 Al discloses another control system which 
35 is suitable for controlling a vehicle equipped with an 
electronically actuatable drive train. A memory device 
stores vehicle data relevant to vehicle movement 
dynamics, time data, position data, actuation signals 



- 2 - 

from the driver and triggering signals for the drive 
train generated by a control device. Such a control 
system allows improved accident analysis. 

5 In today's vehicles, the service brake comprises 
hydraulic brake actuators, which are associated with 
the individual vehicle wheels. To increase vehicle 
safety, a two-circuit system is generally provided, in 
which two independent hydraulic circuits are provided, 

10 one of which serves to actuate the brake actuators 
associated with the rear axle while the other serves to 
actuate the brake actuators associated with the front 
axle. With this construction, the brake actuators 
associated with the same axle are coupled together via 

15 the common hydraulic circuit. This coupling means that, 
if one of the hydraulic circuits fails, all the brake 
actuators linked into this hydraulic circuit always 
fail. 

2 0 EP 0 832 800 A2 discloses an electronic braking system 
with various hierarchical levels for the architecture 
of the brake control system. In addition to vehicle 
modules, wheel modules are provided which exchange 
messages with a central module within one hierarchical 

25 level via a data bus. EP 1 231 121 A2 also describes 
the structural configuration of a data bus system for 
brake actuation. 

This is where the present invention comes in. The 
30 invention deals with the problem of providing an 
improved embodiment for a vehicle of the abovementioned 
type, which embodiment offers in particular increased 
safety. 

35 This problem is solved according to the invention by 
the subject matter of the independent claim. 
Advantageous embodiments constitute the subject matter 
of the dependent claims . 
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The invention is based on the general concept of 
providing the service brake with electronically 
actuatable brake units associated with the individual 
wheels, which brake units may be actuated independently 
5 of one another by two central, redundantly connected 
service brake control devices. In this way, a four- 
circuit system may be produced, for example, without a 
particularly high degree of complexity being required 
therefor. In particular, no hydraulic lines have to be 

10 installed, since the control lines used to actuate the 
brake units merely have to be suitable for transmitting 
electrical control signals and thus are considerably 
cheaper than hydraulic lines. The electrical control 
lines are not only cheaper to purchase than hydraulic 

15 lines but also require less effort to install. The 
second central control device is used to provide a 
redundant brake control system, by means of which it is 
possible to improve considerably the fail safety of the 
brake system. The two control devices are connected to 

2 0 the individual brake units in such a way that both 
control devices operate permanently in parallel and may 
replace one another immediately and completely in the 
event of failure. At the same time, the line 
arrangement according to the invention reduces the 

2 5 amount of line material used and the labor required for 

installation . 

Further important features and advantages of the 
invention are revealed by the subordinate claims, the 

3 0 drawings and the associated description of the figures 

made with reference to the drawings - 

It goes without saying that the abovementioned features 
and those still to be explained below may be used not 
35 only in the respectively stated combination but also in 
other combinations or alone, without going beyond the 
scope of the present invention. 
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Preferred exemplary embodiments of the invention are 
illustrated in the drawings and are explained in more 
detail in the following description, wherein the same 
reference numerals refer to identical or functionally 
5 identical or similar components. 

In the, in each case schematic, drawings. 

Figs 1 to 7 show greatly simplified diagrams of a 
10 vehicle with a brake control system 

according to the invention, in various 
embodiments . 

According to Fig. 1, a vehicle 1 illustrated only in 
15 part comprises at least one front axle 2 and at least 
one rear axle 3- With regard to the direction of 
travel, the front axle 2 has at least one left-hand 
front wheel 4 and at least one right-hand front wheel 
5. Likewise, with regard to the direction of travel, 

2 0 the rear axle 3 also has at least one left-hand rear 

wheel 6 and at least one right-hand rear wheel 7. It is 
clear that, in another embodiment, the vehicle 1 may 
also comprise a plurality of rear axles 3 and in 
particular also a plurality of front axles 2. Moreover, 
25 in the case of a rear axle 3, the individual rear 
wheels 6, 7 may for example take the form of dual 
wheels or twin wheels. 

Furthermore, the vehicle 1 is provided with a service 
30 brake 8, by means of which the vehicle 1 may be braked, 
wherein the service brake 8 serves to brake the 
individual wheels 4 to 7 of the vehicle 1. For each 
brakable wheel 4 to 7, the service brake 8 comprises a 
separate brake unit, namely a front left-hand brake 

3 5 unit 9, a front right-hand brake unit 10, a rear left- 

hand brake unit 11 and a rear right-hand brake unit 12. 
The brake units 9 to 12 are in each case designed to be 
electronically actuatable. For example, the brake units 
9 to 12 are electromechanical brake units, which 
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convert electrical energy into mechanical braking work. 
For example, such an electromechanical brake has an 
electric motor as actuator, said motor, when actuated, 
pressing conventional brake shoes against a 
5 conventional brake disc. 

The service brake 8 forms an essential component of a 
brake control system 45, which is additionally equipped 
with a first central control device 13, which is 
connected to the brake units 9 to 12 via at least one 
control line. Linkage or coupling to the brake units 9 
to 12 is effected in such a way that the first central 
control device 13 may actuate the individual brake 
units 9 to 12 independently of one another. In the 
embodiment according to Fig. 1, four such control lines 
14, 15, 16, 17 are provided. 

Moreover, the brake control system 4 5 comprises a 
second central control device 18, which is connected 
redundantly to the first central control device 13. In 
this way, the operating and functional safety of the 
service brake 8 or of the brake control system 4 5 may 
be improved, since, in the event of failure of the 
first central control device 13, the second central 
control device 18 may provide an adequate replacement 
for the first central control device 13 . The vehicle 1 
is thus provided with a redundant brake control system 
45 . 

30 In the embodiments illustrated herein, the service 
brake 8 takes the form of a wired system, i.e. it has 
no compulsory mechanical or hydraulic coupling between 
a braking force setpoint generator, such as for example 
a brake pedal, and the individual brake units 9 to 12 . 

3 5 Preferably, the system is here accordingly what is 
termed a "brake -by -wire system", in which a braking 
command is forwarded electrically to the individual 
brake units 9 to 12 and implemented there. Accordingly, 
the control lines 14 to 17 comprise electrical leads 
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for transmitting electrical signals, which serve to 
actuate the individual brake units 9 to 12 . 



The electronic coupling between an input level of the 
5 brake control system 45, which takes the form of a 
braking force setpoint generator, for example a brake 
pedal, and an output level of the brake control system 
45, which takes the form of brake units 9 to 12 
cooperating with the wheels 4 to 7, is preferably 

10 hierarchically structured in the case of the invention. 
To this end, first of all a brake modulator 20 is 
provided, which determines an axle brake command for 
each axle 2, 3 as a function of preset values relating 
to vehicle movement dynamics. The preset values for 

15 vehicle movement dynamics taken into account here may 
consist not only of a setpoint for vehicle deceleration 
desired by the vehicle driver but also of current state 
variables of a stabilization system, such as for 
example steering angle and/or transverse acceleration, 

2 0 which may have an effect on the respective braking 
operation. An axle modulator 21 or 22 respectively for 
each axle 2, 3 is then connected downstream of the 
brake modulator 20. Each axle modulator 21, 22 
determines a wheel braking command for each assigned 

25 wheel 4 to 7 from the associated axle braking command. 
While the axle braking commands may differ from one 
another in that the brake modulator 2 0 assigns 
different braking moments to the individual axles 2, 3, 
the wheel braking commands may differ from one another 

30 within the respective axle 2, 3 through a different 
left -right distribution of the desired braking forces. 

A separate wheel modulator 23 to 2 6 for each wheel 4 to 
7 is then arranged downstream of the individual axle 
35 modulators 21, 22. The wheel modulators 23 to 26 
determine as a function of the associated wheel braking 
commands actuating signals for actuating brake 
actuators 27 to 30, which are associated with the 
respective brake unit 9 to 12. The brake actuators 27 
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to 30 then individually execute the respective wheel 
braking command. The structure used makes it possible, 
inter alia, to arrange the individual required wheel 
modulators 20 to 26 non- centrally. In the embodiments 
5 of Figs 1, 2, 6 and 1, the wheel modulators 23 to 26 
are arranged for example on the individual brake units 
9 to 12 or integrated therein. In contrast thereto, in 
the embodiments of Figs 1 and 2, the axle modulators 
21, 22 are integrated into the first control device 13 
10 or into the brake modulator 20. Likewise, the. brake 
modulator 2 0 is integrated into the first control 
device 13 in all variants. 

The brake control system 4 5 is conveniently equipped 
15 with a dynamic system for vehicle stabilization. Such a 
stabilization system is for example an anti-lock 
braking system (ABS) , anti-slip regulation (ASR) or a 
so-called ESP system. Likewise, an electronic all-wheel 
system may contribute to vehicle stabilization. 

20 

The hierarchical structure of the brake control system 
45 makes it possible to arrange or provide wheel - 
specific components of such a stabilization system in 
the axle modulators 21, 22. Likewise, axle-specific 
25 and/or vehicle-specific components of these 
stabilization systems may then be arranged or provided 
in the brake modulator 20. Moreover, the wheel 
modulators 23 to 26 may comprise local control loops, 
which act in the plane of the respective wheel 4 to 7 . 

30 

In principle, the second control device 18 may be 
identical in structure to the first control device 13, 
so as to be able to replace the latter completely in an 
emergency. Operation of the vehicle 1 is then not 
35 restricted in any way in the event of failure of the 
first control device 13 . Accordingly, the second 
control device 18 also comprises a brake modulator 20' 
and two axle modulators 21' and 22' respectively. In 
contrast thereto, it is also possible to assign reduced 



- 8 - 

functionality to the second control device 18 compared 
to the first control device 13, whereby the second 
control device 18, which is not needed as a rule, may 
be produced more cheaply - 

5 

In the embodiments of Figs 1 to 7, the operating safety 
of the redundant brake control system 4 5 is increased 
according to the invention in that, of the two front 
control lines 14, 15 provided for actuation of those 

10 brake units 9, 10 which are associated with the front 
axle 2, at least one or the first, here the left-hand 
control line 14, is connected to the first central 
control device 13. In contrast thereto, of the two rear 
control lines 16, 17 which serve to actuate those brake 

15 units 11, 12 which are associated with the rear axle 3, 
at least one or the first, here the right-hand control 
line 17, is connected to the second central control 
device 18. Furthermore, in the embodiments of Figs 1 to 
3, the other one or second of the front control lines 

20 14, 15, i.e. here the right-hand control line 15, is 
connected to the second control device 18, while the 
other one or second of the two rear control lines 16, 
17, i.e. here the left-hand control line 16, is 
connected to the first control device 13 . In this way, 

25 the brake units 9, 10 of the front axle 2 and the brake 
units 11, 12 of the rear axle 3 are automatically 
connected to both control devices 13, 18 via separate 
control lines 14 to 17. 

30 A redundant connection is then provided in the area of 
the individual axles 2, 3. To this end, in the 
embodiment according to Fig. 3 the two front control 
lines 14, 15 are each connected to both wheel 
modulators 23, 24, for which purpose a corresponding 

35 auxiliary line 14' or 15* respectively branches off 
from the respective control line 14, 15. The same takes 
place with regard to the rear axle 3, such that the 
left-hand rear control line 16 is connected to the rear 
left-hand wheel modulator 25 and via an auxiliary 
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control line 16' to the rear right-hand wheel modulator 
26, Likewise, the rear right-hand control line 17 is 
connected directly to the rear right-hand wheel 
modulator 26 and indirectly via an auxiliary control 
5 line 17' to the rear left-hand wheel modulator 25. It 
is clear in this regard that the respective control 
device 13, 18 ultimately emits coded" wheel braking 
commands for all the vehicle wheels 4 to 7, such that, 
in the event of failure of one of the control devices 
10 13, 18, the wheel braking commands produced by the 
remaining control device 13 or 18 respectively always 
reach the respective wheel modulator 23 to 26 as a 
result of the networking provided. 

15 In the embodiment according to Fig. 2, the redundant 
connection in the area of the axles 2, 3 is achieved in 
that, on the one hand, at each axle 2, 3 the two 
control lines 14, 15 or 16, 17 respectively connect the 
one wheel modulator 2 3 or 2 5 to the first control 

2 0 device 13 and the other wheel modulator 24 or 26 to the 
second control device 18. On the other hand, a coupling 
line 35 or 36 is provided at each axle 2, 3, which line 
connects together the two wheel modulators 23 and 24 or 
respectively 25 and 26 of the respective axle 2, 3. 

2 5 These coupling lines 35, 3 6 are designed or connected 

such that they transmit the signals, supplied via the 
one control line 14 or 15 or respectively 16 or 17 to 
the one wheel modulator 2 3 or 24 or 2 5 or 26, 
respectively, to the respective other wheel modulator 

3 0 24 or 23 or 26 or 25 on the same axle 2, 3. Thus, 

networking is achieved here too, so making it possible, 
in the event of failure of one of the control devices 
13, 18, to reach the brake units 9 to 12 with the 
remaining control device 13, 18 via the networking in 
3 5 the area of the axles 2, 3. By means of such networking 
in the area of the axles 2, 3, it is in principle also 
possible to connect the first, for example the left- 
hand front control line 14 to the first control device 
13 and the first or right-hand rear control line 17 to 
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the second control device 18 and moreover to connect 
the second or right-hand front control line 15 to the 
second or left-hand rear control line 16. In this way, 
networking is provided here too, which makes it 
5 possible, in the event of failure of one of the two 
control devices 13, 18, to reach all the wheel 
modulators 23 to 26 individually with the control 
commands of the remaining control device 13, 18. 

10 In the embodiments of Figs 3 to 7, the axle modulators 
21 and 22 are each arranged on or near to the 
associated axle 2 or 3 respectively. In these variants, 
the axle modulators 21, 22 are thus arranged non- 
centrally relative to the control devices 13, 18. In 

15 this way, a complete mechatronic axle module may be 
produced, which for example makes possible local ABS 
control of the respective axle 2, 3. 

In the embodiments of Figs 3 to 5, the wheel modulators 
20 23 to 26, which are associated with the wheels 4 to 7 
of the same axle 2 or 3 respectively, are each 
integrated into the axle modulator 21 or 22 
respectively associated with said axle 2, 3. In this 
way, jointly usable components, such as for example 
25 power supply units, may for example be used for both 
wheel modulators 23 to 26 on the same axle 2, 3. 
Integration of the wheel modulators 23 to 26 into the 
axle modulators 21, 22 therefore brings about a saving 
in hardware components. 

30 

In addition to arranging or integrating the wheel 
modulators 23 to 2 6 on or in the brake units 9 to 12 or 
in the axle modulators 21, 22, it is in principle also 
possible to accommodate the wheel modulators 23, 26 in 
3 5 the respective central control device 13 or 18 
respectively or to integrate them therein. 

In the embodiments of Figs 3 to 7, both front control 
lines 14, 15 are connected to the front axle modulator 
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21, which is associated with the front axle 2. 

Likewise, both rear control lines 16, 17 are also 

connected to the rear axle modulator 22, which is 

associated with the rear axle 3 - The variants of Figs 3 

5 to 5 differ through different networking of the axle 
modulators 21, 22 with the two control devices 13, 18. 

In the embodiment according to Fig. 3, the first or 
left-hand front control line 14 is connected to the 

10 first control device 13, while the second or right-hand 
front control line 15 is connected to the second 
control device 18. Likewise, the first or right-hand 
rear control line 17 is connected to the second control 
device 18, while the second or left-hand rear control 

15 line 16 is connected to the first control device 13, In 
other words, both control devices 13, 18 directly 
actuate both axle modulators 21, 22. 

In the embodiment according to Fig. 4, the first, left- 

2 0 hand front control line 14 is again connected to the 
first control device 13, while the first, right-hand 
rear control line 17 is again connected to the second 
control device 18. In contrast, the second control 
lines, i.e. the right-hand front control line 15 and 

25 the left-hand rear control line 16, are connected 
directly together. The two axle modulators 21, 22 are 
designed such that they transmit signals, supplied by 
the respective control device 13, 18 via the in each 
case first control line 14, 17, via the second control 

30 lines 15, 16 to the in each case other axle modulator 
21, 22. In this way networking is likewise provided, 
but with less complex wiring, said networking allowing 
actuation of all the wheel modulators 23 to 26 or all 
the brake units 9 to 12 on failure of one of the two 

35 control devices 13, 18. 

Fig, 5 shows a further alternative development with 
regard to networking of the axle modulators 21, 22 with 
the control devices 13, 18. In this embodiment, the 
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first or left-hand front control line 14 is connected 
to the first control device 13, while the first or 
right-hand rear control line 17 is connected to the 
second control device. Furthermore, the first front 
5 control line 14 is additionally connected to the 
second, left-hand rear control line 16. Likewise, the 
first rear control line 17 is connected to the second, 
right-hand front control line 15. Networking is also 
achieved in this way, said networking allowing 
10 actuation of all the brake units 9 to 12 with the 
remaining control device 13, 18 should one of the 
control devices 13, 18 fail. 

Figs 6 and 7 show examples of additional networking in 
15 the area of the respective axles 2, 3 for instances in 
which the individual wheel modulators 2 3 to 2 6 are not 
integrated into the axle modulators 21, 22 but rather 
are arranged on or in the brake units 9 to 12 . In these 
embodiments the axle modulators 21, 22 are each 
20 connected via two axle control lines 37 to 40 to the 
two wheel modulators 23 to 26 of the associated axle 2, 
3 . In order to provide additional networking of the 
wheel modulators 2 3 to 2 6 in the area of the respective 
axle 2, 3, in the embodiment according to Fig. 6 the 
25 two axle control lines 37, 38 or 39, 40 are 
respectively connected to the two wheel modulators 23, 
24 or respectively 25, 26 of the associated axle 2, 3, 
this being achieved via corresponding auxiliary or 
branch lines 37' to 40'. 

30 

Alternatively, networking of the wheel modulators 23 to 
26 corresponding to the embodiment shown in Fig. 7 may 
also be achieved in that on the one hand the axle 
control lines 37 to 40 of the axle modulators 21, 22 
3 5 are each connected to only one of the wheel modulators 
23 to 26. In addition, on the other hand the two wheel 
modulators 23, 24 or respectively 25, 26 of the 
respective axle 2, 3 are connected together via a 
coupling line 41 or 42, respectively. The individual 
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wheel modulators 23 to 2 6 are then designed such that 
they transmit signals, supplied to them via the 
associated actuating line 37 to 40, via the respective 
coupling line 41, 42 to the respective other wheel 
5 modulator 2 3 to 2 6 of the same axle 2, 3. 

In the embodiments of Figs 3 to 7, the axle modulators 
21, 22 are each accommodated in an axle control device 
43 or 44, respectively, which is arranged in each case 
10 on or near to the respective axle 2 or 3 , respectively. 
In the embodiments of Figs 3 to 5, the wheel modulators 
23 to 26 are integrated into the axle control device 43 
or 44 assigned to the associated axle 2, 3. 

15 In order to be able to bring about the networking 
described herein, the individual control lines 14 to 17 
or the individual axle control lines 37 to 4 0 or the 
individual coupling lines 35, 36 or 41, 42 respectively 
preferably each take the form of buses, such that the 

2 0 individual control commands may be sent as coded 
signals over the network produced in this way. 

The variants shown in Figs 1 to 7 for networking the 
brake units 9 to 12 with the control devices 13, 18 may 
25 - where appropriate - be combined in any desired way, 
in particular the networking at the level of the axles 
2, 3 according to Figs 6 and 7 may also be combined 
with the networking at the level of the control devices 
13, 18 according to Figs 1 to 5 • 

30 

The first control device 13 and, where present, also 
the second control device 18 preferably comprises 
wheel -specific components of a steer-by-wire system and 
may additionally be designed such that it actuates the 
35 individual brake units 9 to 12 during a braking 
operation as a function of a braking algorithm, which 
is designed such that it allows intervention in the 
steering of the vehicle if certain parameters are 
present- Such intervention in steering is intended for 
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example in the case of a dynamic vehicle stabilization 
system, which is known in specialist circles as ESP 
III. In this configuration, parts of such a 
stabilization system are thus already linked within the 
5 control device 13, 18 to suitable components of the 
steer-by-wire system, which improves the performance of 
the stabilization system and reduces the price of such 
a system. 

Another particularly advantageous configuration is one 
in which the first control device 13 and in particular 
also the second control device 18 executes a 
coordination algorithm during a braking operation, in 
order to distribute a braking force necessary for 
braking the vehicle as a function of this coordination 
algorithm to the service brake 8 and, where present, to 
an engine brake of the vehicle 1 and, where present, to 
a retarder of the vehicle 1. Provision may also be made 
to enhance the engine brake by actuating an actuatable 
transmission in the change-down direction. Optimum 
distribution of the braking force to the various 
braking systems of the vehicle 1 reduces the wear and 
energy consumption of the vehicle 1. For example, minor 
braking operations may be performed solely with the 
retarder or solely with the engine brake, which both 
operate in wear- free manner compared with the service 
brake 8 . 

The first control device 13 and preferably also the 
3 0 second control device 18 operates in normal operation 
with a main braking algorithm, which ensures during a 
braking process that the braking force to be achieved 
by means of the service brake 8 is distributed to the 
individual brake units 9 to 12 as a function of this 
35 main braking algorithm. In addition to the main braking 
algorithm, the first control device 13 and in 
particular also the second control device 18 may be 
equipped with at least one emergency braking algorithm, 
which replaces the main braking algorithm in emergency 
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operation. Different emergency braking algorithms may 
be provided for different instances of emergency 
operation. Such emergency operation is characterized by 
the failure of at least one brake unit 9 to 12. A 
5 suitable emergency braking algorithm may then be 
determined or selected for the particular instance of 
emergency operation, which then actuates the remaining 
functional brake units 9 to 12 to brake the vehicle 1 
as a function of the respective emergency braking 

10 algorithm, wherein this emergency braking algorithm 
takes account of the respectively failed brake unit 9 
to 12 when distributing the braking force to the 
remaining functional brake units 9 to 12. In this way 
it is possible, within certain limits, to achieve 

15 comparatively safe braking of the vehicle 1 even in the 
event of failure of one or more brake units 9 to 12 . An 
essential feature in implementing such a safety concept 
is the provision of a four-circuit system in the case 
of four brake units 9 to 12, this being achieved in the 

20 invention by the possibility of separate actuation of 
the individual brake units 9 to 12 . 



